ScreenConnect.ClientSetup.msi Executed via msiexec from Download Directory

Ethan Andrews@eandrews

•updated Aug 3, 2026•9•0•16

Detects the execution of msiexec.exe to install ScreenConnect.ClientSetup.msi when initiated from user-controlled directories like Downloads or Temp folders. This behavior is indicative of potential social engineering or phishing attacks leveraging legitimate remote access software installers.